@agents-ensemble/core 0.21.0 → 0.22.0

package/dist/conductor/conductor-session-driver.js

@@ -1,5 +1,6 @@
 import { ensureMaxTurnsOpenQuestion } from '../escalation/enqueue-max-turns-question.js';
-import { isPiApiKeyResolutionFailure } from './conductor-auth.js';
+import { ConductorDispatchLifecycle, settleConductorDispatch, } from './conductor-dispatch-lifecycle.js';
+import { ConductorRecoveryInbox } from './conductor-recovery-inbox.js';
 import { reconnectConductorAgent, sendConductorWithReconnect, } from './conductor-send-reconnect.js';
 import { formatSessionEventsForConductor } from './session/format-session-event.js';
 import { bufferDispatchHoldEvents, createDispatchHoldState, pruneStalePermissionEvents, } from './session/dispatch-hold.js';
@@ -20,15 +21,85 @@ export async function runConductorSessionDriver(options) {
         runId: '',
         status: 'finished',
     };
+    let cursorBootstrapPending = options.recoveryBackend === 'cursor' &&
+        (options.cursorBootstrapState
+            ? options.cursorBootstrapState.status === 'incomplete'
+            : options.cursorBootstrapComplete === undefined
+                ? !options.skipInitialSend
+                : !options.cursorBootstrapComplete);
+    let cursorBootstrapCompletedThisDriver = false;
     let inFlightSend;
     let postLoopWaiting = false;
+    const lifecycle = options.dispatchLifecycle ??
+        new ConductorDispatchLifecycle();
+    const recoveryInbox = options.recoveryInbox ?? new ConductorRecoveryInbox();
     const dispatchHoldState = options.dispatchHoldState ?? createDispatchHoldState();
-    let conductorAvailable = true;
-    let pendingAuthRecoveryCandidate;
-    let pendingRecoveryReport;
-    const sendReconnect = withAgentAvailabilityCallbacks(options.sendReconnect, (available) => {
-        conductorAvailable = available;
+    const cursorBootstrapNeedsDecision = () => options.cursorBootstrapState?.status === 'unknown' ||
+        options.cursorBootstrapState?.status === 'saving';
+    const isCursorBootstrapPending = () => {
+        if (options.recoveryBackend !== 'cursor')
+            return false;
+        if (options.cursorBootstrapState) {
+            return (options.cursorBootstrapState.status === 'incomplete' &&
+                !cursorBootstrapCompletedThisDriver);
+        }
+        return cursorBootstrapPending;
+    };
+    const markCursorBootstrapCompleted = () => {
+        cursorBootstrapPending = false;
+        cursorBootstrapCompletedThisDriver = true;
+    };
+    let automaticReconnect;
+    const sendReconnect = withAgentAvailabilityCallbacks(options.sendReconnect, (reason, info) => {
+        lifecycle.setAgentAvailable(info.success);
+        if (info.source === 'automatic') {
+            automaticReconnect = { reason, succeeded: info.success };
+        }
     });
+    const settleAttempt = (input) => {
+        const outcome = settleConductorDispatch({
+            lifecycle,
+            lease: input.lease,
+            inbox: recoveryInbox,
+            ...(input.reservation ? { reservation: input.reservation } : {}),
+            workflow: 'issue',
+            backend: options.recoveryBackend ?? 'pi',
+            sendCount: input.sendCount,
+            sourceKey: input.sourceKey,
+            eventTypes: input.events.map((event) => event.type),
+            operatorInputTexts: input.lease.payload.operatorInputTexts,
+            result: input.result,
+            ...(automaticReconnect
+                ? { automaticReconnect: { ...automaticReconnect } }
+                : {}),
+            toolCallStarted: input.toolCallStarted,
+            captureFailure: !options.shutdownSignal.aborted &&
+                options.operatorCanInspectRecovery === true,
+            ...(input.requiresConfirmation !== undefined
+                ? { requiresConfirmation: input.requiresConfirmation }
+                : {}),
+            ...(input.result.status === 'send_rejected'
+                ? { agentAvailable: false }
+                : {}),
+        });
+        automaticReconnect = undefined;
+        if (!outcome.completed &&
+            !options.shutdownSignal.aborted &&
+            outcome.failureClass) {
+            options.onRecoveryAttention?.({
+                attemptId: input.lease.attemptId,
+                sourceKey: input.sourceKey,
+                status: input.result.status,
+                failureClass: outcome.failureClass,
+                confirmationRequired: lifecycle.confirmationRequired,
+                pendingOperatorMessageCount: options.eventQueue
+                    .snapshot()
+                    .filter((event) => event.type === 'operator.message').length,
+                ...(outcome.snapshot ? { snapshot: outcome.snapshot } : {}),
+                agentAvailable: lifecycle.available,
+            });
+        }
+    };
     const hasDispatchableWorkerOutcome = () => selectDispatchBatch({
         queue: options.eventQueue.snapshot().filter((event) => event.type === 'worker.completed' || event.type === 'worker.failed'),
         state: dispatchBatchState,
@@ -45,7 +116,14 @@ export async function runConductorSessionDriver(options) {
         const holdBlocksStop = dispatchHoldState.heldEvents.length > 0 &&
             options.stopOnUnansweredInput !== true &&
             loopState.lastStatus !== 'error' &&
+            loopState.lastStatus !== 'send_rejected' &&
             loopState.lastStatus !== 'cancelled';
+        if (lifecycle.confirmationRequired &&
+            options.operatorCanInspectRecovery !== true) {
+            stopReason =
+                loopState.lastStatus === 'cancelled' ? 'cancelled' : 'error';
+            return true;
+        }
         if (holdBlocksStop) {
             postLoopWaiting = false;
             return false;
@@ -54,6 +132,13 @@ export async function runConductorSessionDriver(options) {
             postLoopWaiting = false;
             return false;
         }
+        if (options.operatorCanInspectRecovery && lifecycle.confirmationRequired) {
+            if (!postLoopWaiting) {
+                postLoopWaiting = true;
+                options.onIssueLoopStop?.();
+            }
+            return false;
+        }
         // A worker publishes its outcome to the inbox before its runtime round
         // leaves the running state. Drain that notification chain before
         // deciding the session is idle, otherwise the driver can tear down in
@@ -79,15 +164,69 @@ export async function runConductorSessionDriver(options) {
         }
         return false;
     };
+    if (options.shutdownSignal.aborted) {
+        stopReason = 'interrupted';
+        return {
+            stopReason,
+            sendCount,
+            lastSendResult,
+            autonomousTurns,
+            lastDispatchesThisTurn,
+        };
+    }
+    if (options.cursorBootstrapState && !options.skipInitialSend) {
+        try {
+            await waitForCursorBootstrapDecision({
+                state: options.cursorBootstrapState,
+                lifecycle,
+                eventQueue: options.eventQueue,
+                onOperatorQueueChanged: options.onOperatorQueueChanged,
+                signal: options.shutdownSignal,
+            });
+        }
+        catch (error) {
+            if (!isAbortError(error))
+                throw error;
+            stopReason = 'interrupted';
+            return {
+                stopReason,
+                sendCount,
+                lastSendResult,
+                autonomousTurns,
+                lastDispatchesThisTurn,
+            };
+        }
+    }
     if (!options.skipInitialSend) {
+        const initialPrompt = await Promise.resolve(options.initialPrompt);
+        if (options.shutdownSignal.aborted) {
+            stopReason = 'interrupted';
+            return {
+                stopReason,
+                sendCount,
+                lastSendResult,
+                autonomousTurns,
+                lastDispatchesThisTurn,
+            };
+        }
+        const initialLease = lifecycle.beginSend({
+            events: [],
+            sourceKey: 'initial',
+            operatorInputTexts: [],
+        });
+        if (!initialLease) {
+            throw new Error('Could not acquire the initial conductor send lease.');
+        }
+        automaticReconnect = undefined;
+        let initialToolCallStarted = false;
         options.onConductorInbound?.({
             triggers: 1,
             sources: ['initial'],
         });
-        lastSendResult = await runEventConductorSend({
-            // Keep the initial dispatch asynchronous as it was when the driver
-            // fetched and compiled the prompt itself.
-            message: await Promise.resolve(options.initialPrompt),
+        const initialSend = runEventConductorSend({
+            // The initial result is consumed before the event loop begins, but the
+            // wait still follows the same shutdown interruption contract as sends.
+            message: initialPrompt,
             conductorHandle: options.conductorHandle,
             sendReconnect,
             signal: options.shutdownSignal,
@@ -100,20 +239,80 @@ export async function runConductorSessionDriver(options) {
             resetOutboundDispatchesThisSend: options.resetOutboundDispatchesThisSend,
             getOutboundDispatchesThisSend: options.getOutboundDispatchesThisSend,
             onSendStarted: options.onSendStarted,
-            onSendProgress: options.onSendProgress,
+            onSendProgress: (info) => {
+                initialToolCallStarted = true;
+                options.onSendProgress?.(info);
+            },
             onSendComplete: (info) => {
                 sendCount = info.sendCount;
                 lastDispatchesThisTurn = info.conductorDispatchesThisTurn;
                 autonomousTurns = info.autonomousTurns;
                 options.onSendComplete(info);
             },
+        }).then((result) => {
+            if (options.recoveryBackend === 'cursor' &&
+                isIssueDispatchCompleted(result)) {
+                markCursorBootstrapCompleted();
+            }
+            const explicitInterruptQueued = result.status === 'cancelled' &&
+                options.eventQueue.snapshot().some((event) => event.type === 'operator.message' &&
+                    event.delivery === 'interrupt');
+            settleAttempt({
+                lease: initialLease,
+                events: [],
+                sourceKey: 'initial',
+                sendCount,
+                result,
+                toolCallStarted: initialToolCallStarted,
+                ...(explicitInterruptQueued ? { requiresConfirmation: false } : {}),
+            });
+            return result;
         });
+        const awaitedInitialSend = await awaitWithAbort(initialSend, options.shutdownSignal);
+        if (awaitedInitialSend.aborted || options.shutdownSignal.aborted) {
+            stopReason = 'interrupted';
+            return {
+                stopReason,
+                sendCount,
+                lastSendResult,
+                autonomousTurns,
+                lastDispatchesThisTurn,
+            };
+        }
+        lastSendResult = awaitedInitialSend.value;
     }
     while (true) {
         if (options.shutdownSignal.aborted) {
             stopReason = 'interrupted';
             break;
         }
+        if (options.cursorBootstrapState && cursorBootstrapNeedsDecision()) {
+            try {
+                await waitForCursorBootstrapDecision({
+                    state: options.cursorBootstrapState,
+                    lifecycle,
+                    eventQueue: options.eventQueue,
+                    onOperatorQueueChanged: options.onOperatorQueueChanged,
+                    signal: options.shutdownSignal,
+                });
+            }
+            catch (error) {
+                if (!isAbortError(error))
+                    throw error;
+                stopReason = 'interrupted';
+                break;
+            }
+            if (options.shutdownSignal.aborted) {
+                stopReason = 'interrupted';
+                break;
+            }
+        }
+        if (lifecycle.confirmationRequired &&
+            options.operatorCanInspectRecovery !== true) {
+            stopReason =
+                lastSendResult.status === 'cancelled' ? 'cancelled' : 'error';
+            break;
+        }
         if (options.isPermissionPending) {
             pruneStalePermissionEvents({
                 state: dispatchHoldState,
@@ -182,7 +381,8 @@ export async function runConductorSessionDriver(options) {
             const shouldBreak = await shouldBreakAfterLoopState(loopState);
             const idleOperatorMessageReady = queuedDispatch?.batch.events.some((event) => event.type === 'operator.message' && event.delivery === 'idle');
             if (shouldBreak &&
-                (!idleOperatorMessageReady || options.stopOnUnansweredInput === true)) {
+                (!idleOperatorMessageReady ||
+                    options.stopOnUnansweredInput === true)) {
                 break;
             }
             continue;
@@ -214,13 +414,15 @@ export async function runConductorSessionDriver(options) {
                 dispatchBatchState,
                 autonomousTurns,
                 maxTurns: options.maxTurns,
+                lifecycle,
+                recoveryInbox,
+                operatorCanInspectRecovery: options.operatorCanInspectRecovery === true,
                 signal: options.shutdownSignal,
                 dispatchHoldState,
                 onDispatchHoldChanged: options.onDispatchHoldChanged,
                 onOperatorQueueChanged: options.onOperatorQueueChanged,
+                onRecoveryCapacityBlocked: options.onRecoveryCapacityBlocked,
                 isPermissionPending: options.isPermissionPending,
-                isConductorAvailable: () => conductorAvailable,
-                hasPendingRecoveryReport: () => pendingRecoveryReport !== undefined,
                 canDispatchIdleOperatorMessage: () => canDispatchIdleOperatorMessage({
                     eventQueue: options.eventQueue,
                     dispatchHoldState,
@@ -242,38 +444,56 @@ export async function runConductorSessionDriver(options) {
             continue;
         }
         if (options.shutdownSignal.aborted) {
+            if (dispatchResult.reservation) {
+                recoveryInbox.release(dispatchResult.reservation);
+            }
             stopReason = 'interrupted';
             break;
         }
-        const { events: selectedBatch, selected } = dispatchResult;
+        const { events: batch, selected, reservation } = dispatchResult;
         postLoopWaiting = false;
-        if (selected) {
-            dispatchBatchState = markContinuationConsumed(dispatchBatchState, selected);
-        }
         if (dispatchResult.sourceKey === 'operator.reconnect') {
+            const reconnectLease = lifecycle.beginReconnect();
+            if (!reconnectLease)
+                continue;
+            options.eventQueue.removeEvents(batch);
+            if (selected) {
+                dispatchBatchState = markContinuationConsumed(dispatchBatchState, selected);
+            }
             dispatchBatchState = dispatchBatchStateAfterSend(dispatchResult.sourceKey);
             const reconnected = await runOperatorReconnect(options);
-            conductorAvailable = reconnected;
+            lifecycle.settleReconnect(reconnectLease, reconnected);
             if (reconnected && !options.shutdownSignal.aborted) {
-                // 再接続の await 中に届いた reconnect は今回の成功で満たされた。
-                // 新しい handle を重ねて close / resume しないよう、ここでまとめて消費する。
+                // 再接続待ちの間に積まれた /reconnect は今回の復旧で満たされた。
                 options.eventQueue.findSendEvents((event) => event.type === 'operator.reconnect');
-                if (pendingAuthRecoveryCandidate) {
-                    pendingRecoveryReport = {
-                        type: 'conductor.recovery.report',
-                        ...pendingAuthRecoveryCandidate,
-                        reconnect: { kind: 'manual', succeeded: true },
-                    };
-                    pendingAuthRecoveryCandidate = undefined;
-                }
             }
             continue;
         }
-        const recoveryReport = pendingRecoveryReport;
-        const batch = recoveryReport
-            ? [recoveryReport, ...selectedBatch]
-            : selectedBatch;
-        const originalEvents = batch.filter((event) => event.type !== 'conductor.recovery.report');
+        const payload = {
+            events: batch,
+            sourceKey: dispatchResult.sourceKey,
+            operatorInputTexts: dispatchResult.operatorInputTexts,
+        };
+        const lease = lifecycle.beginSend(payload);
+        if (!lease) {
+            if (reservation)
+                recoveryInbox.release(reservation);
+            continue;
+        }
+        if (dispatchResult.fromHeldEvents) {
+            const selectedEvents = new Set(batch);
+            dispatchHoldState.heldEvents = dispatchHoldState.heldEvents.filter((event) => !selectedEvents.has(event));
+            notifyHeldDispatchProgress({
+                dispatchHoldState,
+                onDispatchHoldChanged: options.onDispatchHoldChanged,
+            });
+        }
+        else {
+            options.eventQueue.removeEvents(batch);
+        }
+        if (selected) {
+            dispatchBatchState = markContinuationConsumed(dispatchBatchState, selected);
+        }
         const autonomousTurnsAfter = autonomousTurnsAfterConductorBatch(batch, autonomousTurns);
         const { workerDispatches, workerFailures } = countWorkerOutcomesInBatch(batch);
         options.onOperatorDispatched?.(batch);
@@ -281,18 +501,15 @@ export async function runConductorSessionDriver(options) {
             triggers: batch.filter(isTriggerSessionEvent).length,
             sources: uniqueSources(batch, dispatchResult.sourceKey),
         });
-        // 通常 send を開始したら未報告 candidate は失効する。
-        // 準備済み report はこの send に一度だけ加え、開始時に消費して replay しない。
-        const message = formatSessionEventsForConductor(batch);
-        const recoverySnapshotContent = recoveryReport
-            ? formatSessionEventsForConductor(originalEvents)
-            : message;
-        pendingRecoveryReport = undefined;
-        pendingAuthRecoveryCandidate = undefined;
+        const eventMessage = formatSessionEventsForConductor(batch);
+        const restoreCursorBootstrap = isCursorBootstrapPending();
+        const message = restoreCursorBootstrap
+            ? `${options.initialPrompt}\n\n## 今回のセッションイベント\n\n${eventMessage}`
+            : eventMessage;
         let dispatchHadToolCalls = false;
-        let automaticRetryAttempts = 0;
         const dispatchSend = runEventConductorSend({
             message,
+            ...(restoreCursorBootstrap ? { historyInbound: eventMessage } : {}),
             conductorHandle: options.conductorHandle,
             sendReconnect,
             signal: options.shutdownSignal,
@@ -313,9 +530,6 @@ export async function runConductorSessionDriver(options) {
                 dispatchHadToolCalls = true;
                 options.onSendProgress?.(info);
             },
-            onAutomaticRetryAttempt: ({ attempt }) => {
-                automaticRetryAttempts = attempt;
-            },
             onSendComplete: (info) => {
                 sendCount = info.sendCount;
                 lastDispatchesThisTurn = info.conductorDispatchesThisTurn;
@@ -323,38 +537,31 @@ export async function runConductorSessionDriver(options) {
                 options.onSendComplete(info);
             },
         }).then((result) => {
-            if (isPiApiKeyResolutionFailure(result) && originalEvents.length > 0) {
-                // Pi は1回の send で複数回 auth を解決するため、後続の失敗から
-                // 先行 tool round に副作用がなかったとは判断できない。
-                // event は再送せず、report 用 candidate と operator-only snapshot を別々に保持する。
-                pendingAuthRecoveryCandidate = createPiAuthRecoveryCandidate({
-                    events: originalEvents,
-                    sendCount,
-                    runId: result.runId,
-                    sourceKey: dispatchResult.sourceKey,
-                    automaticRetryAttempts,
-                    toolCallStarted: dispatchHadToolCalls,
-                });
-                const storedSnapshot = options.piAuthRecoverySnapshotStore?.add(pendingAuthRecoveryCandidate, recoverySnapshotContent);
-                if (storedSnapshot) {
-                    options.onPiAuthRecoverySnapshotStored?.(storedSnapshot);
-                }
+            if (restoreCursorBootstrap && isIssueDispatchCompleted(result)) {
+                markCursorBootstrapCompleted();
+            }
+            const explicitInterruptQueued = result.status === 'cancelled' &&
+                options.eventQueue.snapshot().some((event) => event.type === 'operator.message' &&
+                    event.delivery === 'interrupt');
+            settleAttempt({
+                lease,
+                events: batch,
+                sourceKey: dispatchResult.sourceKey,
+                sendCount,
+                result,
+                ...(reservation ? { reservation } : {}),
+                toolCallStarted: dispatchHadToolCalls,
+                ...(explicitInterruptQueued
+                    ? { requiresConfirmation: false }
+                    : {}),
+            });
+            if (options.onDispatchBatchSettled &&
+                batch.some((event) => event.type === 'operator.message')) {
+                options.onDispatchBatchSettled({ events: batch, result });
             }
             return result;
         });
-        if (options.onDispatchBatchSettled &&
-            batch.some((event) => event.type === 'operator.message')) {
-            inFlightSend = dispatchSend.then((result) => {
-                options.onDispatchBatchSettled?.({ events: batch, result });
-                return result;
-            }, (error) => {
-                options.onDispatchBatchSettled?.({ events: batch, error });
-                throw error;
-            });
-        }
-        else {
-            inFlightSend = dispatchSend;
-        }
+        inFlightSend = dispatchSend;
         dispatchBatchState = dispatchBatchStateAfterSend(dispatchResult.sourceKey);
     }
     if (inFlightSend && stopReason !== 'interrupted') {
@@ -372,95 +579,15 @@ function uniqueSources(batch, fallback) {
     const sources = [...new Set(batch.map((event) => eventSourceKey(event)))];
     return sources.length > 0 ? sources : [fallback];
 }
-const MAX_RECOVERY_EVENT_REFERENCES = 20;
-function createPiAuthRecoveryCandidate(input) {
-    const eventReferences = input.events.map((event, index) => ({
-        eventIndex: index + 1,
-        ...recoveryEventReference(event),
-    }));
-    return {
-        recoveryId: `pi-auth-recovery-${input.sendCount}`,
-        failedDispatch: {
-            sendCount: input.sendCount,
-            runId: input.runId,
-            sourceKey: input.sourceKey,
-            eventTypes: [...new Set(input.events.map((event) => event.type))],
-            eventCount: input.events.length,
-            eventReferences: eventReferences.slice(0, MAX_RECOVERY_EVENT_REFERENCES),
-            eventReferencesTruncated: eventReferences.length > MAX_RECOVERY_EVENT_REFERENCES,
-        },
-        failure: {
-            kind: 'pi_api_key_resolution',
-            automaticRetryAttempts: input.automaticRetryAttempts,
-            toolCallStarted: input.toolCallStarted,
-        },
-    };
-}
-function recoveryEventReference(event) {
-    switch (event.type) {
-        case 'operator.message':
-            return {
-                type: event.type,
-                reference: `delivery:${event.delivery ?? 'next'}`,
-            };
-        case 'operator.reconnect':
-            return { type: event.type };
-        case 'worker.completed':
-            return {
-                type: event.type,
-                reference: `worker:${event.result.name}:${event.result.kind}`,
-            };
-        case 'worker.failed':
-            return {
-                type: event.type,
-                reference: `worker:${event.failure.name}:${event.failure.kind}`,
-            };
-        case 'permission.pending':
-            return {
-                type: event.type,
-                reference: `permission:${event.permission.id}`,
-            };
-        case 'permission.stall':
-            return {
-                type: event.type,
-                reference: summarizeRecoveryReferences('permissions', event.pendingPermissionIds),
-            };
-        case 'harness.connectivity.recovered':
-            return {
-                type: event.type,
-                reference: `${event.source}:${event.suppressedErrorCount}`,
-            };
-        case 'conductor.recovery.report':
-            return {
-                type: event.type,
-                reference: `recovery:${event.recoveryId}`,
-            };
-        case 'github.update':
-            return {
-                type: event.type,
-                reference: summarizeRecoveryReferences('items', event.items.map((item) => item.id)),
-            };
-        default: {
-            const _exhaustive = event;
-            return { type: String(_exhaustive) };
-        }
-    }
-}
-function summarizeRecoveryReferences(prefix, values) {
-    const sampleCount = 5;
-    const sample = values.slice(0, sampleCount).join(',');
-    const remaining = values.length - sampleCount;
-    return `${prefix}:${sample}${remaining > 0 ? `,+${remaining} more` : ''}`;
-}
 function withAgentAvailabilityCallbacks(options, onAvailabilityChanged) {
     return {
         ...options,
         onAuthReconnectComplete: (info) => {
-            onAvailabilityChanged(info.success);
+            onAvailabilityChanged('auth', info);
             (options.onAuthReconnectComplete ?? options.onReconnectComplete)?.(info);
         },
         onTransportReconnectComplete: (info) => {
-            onAvailabilityChanged(info.success);
+            onAvailabilityChanged('transport', info);
             (options.onTransportReconnectComplete ?? options.onReconnectComplete)?.(info);
         },
     };
@@ -488,11 +615,14 @@ function runEventConductorSend(input) {
                 tool: info.tool,
             });
         },
-        onAutomaticRetry: (info) => {
-            input.onAutomaticRetryAttempt?.(info);
-            input.sendReconnect.onAutomaticRetry?.(info);
-        },
-    }).then((sendResult) => {
+    })
+        .catch(() => {
+        // Keep sendConductorWithReconnect's public rejection contract. A rejected
+        // send has an unknown provider outcome, so this workflow settles it
+        // locally without retaining the raw exception or retrying the prompt.
+        return { runId: '', status: 'send_rejected' };
+    })
+        .then((sendResult) => {
         const completedDuringSend = input.workerDispatches.length - workersBefore;
         const outboundDispatches = input.getOutboundDispatchesThisSend?.() ?? 0;
         const conductorDispatches = Math.max(completedDuringSend, outboundDispatches);
@@ -502,6 +632,9 @@ function runEventConductorSend(input) {
             runId: sendResult.runId,
             status: sendResult.status,
             inbound: input.message,
+            ...(input.historyInbound !== undefined
+                ? { historyInbound: input.historyInbound }
+                : {}),
             dispatchSource: input.dispatchSource,
             result: sendResult.result,
             error: sendResult.error,
@@ -516,10 +649,18 @@ function runEventConductorSend(input) {
         return sendResult;
     });
 }
+function isIssueDispatchCompleted(result) {
+    return (result.status === 'finished' ||
+        result.status === 'completed' ||
+        result.status === 'running');
+}
 async function waitForDispatchBatch(input) {
+    let capacityNoticeSent = false;
     for (;;) {
-        if (!input.isConductorAvailable()) {
-            const queuedReconnects = input.eventQueue.findSendEvents((event) => event.type === 'operator.reconnect');
+        if (!input.lifecycle.canDispatch) {
+            const queuedReconnects = input.eventQueue
+                .snapshot()
+                .filter((event) => event.type === 'operator.reconnect');
             if (queuedReconnects.length > 0) {
                 if (input.eventQueue
                     .snapshot()
@@ -529,20 +670,11 @@ async function waitForDispatchBatch(input) {
                 return {
                     events: queuedReconnects,
                     sourceKey: 'operator.reconnect',
+                    operatorInputTexts: [],
                 };
             }
-            const reconnect = await input.eventQueue.waitForMatchingEvent((event) => event.type === 'operator.reconnect', input.signal);
-            const reconnects = [
-                reconnect,
-                ...input.eventQueue.findSendEvents((event) => event.type === 'operator.reconnect'),
-            ];
-            if (input.eventQueue.snapshot().some((event) => event.type === 'operator.message')) {
-                input.onOperatorQueueChanged?.();
-            }
-            return {
-                events: reconnects,
-                sourceKey: 'operator.reconnect',
-            };
+            await waitForDispatchChange(input);
+            continue;
         }
         if (input.dispatchHoldState.dispatchHold) {
             bufferDispatchHoldEvents({
@@ -566,75 +698,188 @@ async function waitForDispatchBatch(input) {
             maxTurns: input.maxTurns,
             allowIdleOperatorMessages: input.canDispatchIdleOperatorMessage(),
         });
-        // operator.message は hold 中も通す。permission.stall も hold 対象外の
-        // 低優先度回復通知として queue に残る。release 後は held buffer の
-        // permission.pending を worker より先に選び、max-turns 到達後も dispatch する。
-        if (selected && isImmediateDispatchSource(selected.batch.sourceKey)) {
-            input.eventQueue.replaceQueue(selected.remainingQueue);
+        const prepareDispatch = (dispatch) => {
+            const operatorInputTexts = dispatch.events.flatMap((event) => event.type === 'operator.message'
+                ? [event.operatorInput ?? event.text]
+                : []);
+            const reserved = input.operatorCanInspectRecovery
+                ? input.recoveryInbox.reserve(operatorInputTexts)
+                : { ok: true, reservation: undefined };
+            if (!reserved.ok) {
+                if (reserved.reason === 'input_too_large') {
+                    throw new Error('An operator input reached dispatch without passing the recovery admission limit.');
+                }
+                if (!capacityNoticeSent) {
+                    capacityNoticeSent = true;
+                    input.onRecoveryCapacityBlocked?.();
+                }
+                return undefined;
+            }
             return {
+                events: dispatch.events,
+                sourceKey: dispatch.sourceKey,
+                operatorInputTexts,
+                ...(dispatch.selected ? { selected: dispatch.selected } : {}),
+                ...(reserved.reservation ? { reservation: reserved.reservation } : {}),
+                ...(dispatch.fromHeldEvents ? { fromHeldEvents: true } : {}),
+            };
+        };
+        // Operator input, reconnect, and permission decisions retain their
+        // immediate priority. Lower-priority events must wait while a released hold
+        // contains an eligible permission or worker event.
+        if (selected && isImmediateDispatchSource(selected.batch.sourceKey)) {
+            const dispatch = prepareDispatch({
                 events: selected.batch.events,
                 sourceKey: selected.batch.sourceKey,
                 selected,
-            };
+            });
+            if (dispatch)
+                return dispatch;
+            await waitForDispatchChange(input);
+            continue;
         }
         if (!input.dispatchHoldState.dispatchHold &&
             input.dispatchHoldState.heldEvents.length > 0) {
             const heldEvents = input.dispatchHoldState.heldEvents;
-            if (heldEvents.every((event) => canDispatchConductorSend(event, input.autonomousTurns, input.maxTurns))) {
-                const events = heldEvents.splice(0);
-                notifyHeldDispatchProgress(input);
-                return {
-                    events,
-                    sourceKey: 'dispatch-hold',
-                };
-            }
-            // max-turns blocks worker/GitHub events, but held permission.pending events
-            // remain dispatchable. Reuse the normal selector to preserve their priority.
-            const selectedHeld = selectDispatchBatch({
-                queue: heldEvents,
-                state: input.dispatchBatchState,
-                autonomousTurns: input.autonomousTurns,
-                maxTurns: input.maxTurns,
-            });
-            if (selectedHeld) {
-                input.dispatchHoldState.heldEvents = selectedHeld.remainingQueue;
-                notifyHeldDispatchProgress(input);
-                return {
-                    events: selectedHeld.batch.events,
-                    sourceKey: selectedHeld.batch.sourceKey,
-                    selected: selectedHeld,
-                };
+            const allHeldEventsDispatchable = heldEvents.every((event) => canDispatchConductorSend(event, input.autonomousTurns, input.maxTurns));
+            const selectedHeld = allHeldEventsDispatchable
+                ? undefined
+                : selectDispatchBatch({
+                    queue: heldEvents,
+                    state: input.dispatchBatchState,
+                    autonomousTurns: input.autonomousTurns,
+                    maxTurns: input.maxTurns,
+                });
+            const selectedHeldBatch = selectedHeld?.batch ??
+                (allHeldEventsDispatchable
+                    ? { events: [...heldEvents], sourceKey: 'dispatch-hold' }
+                    : undefined);
+            if (selectedHeldBatch && selectedHeldBatch.events.length > 0) {
+                const dispatch = prepareDispatch({
+                    events: selectedHeldBatch.events,
+                    sourceKey: selectedHeldBatch.sourceKey,
+                    ...(selectedHeld ? { selected: selectedHeld } : {}),
+                    fromHeldEvents: true,
+                });
+                if (dispatch)
+                    return dispatch;
+                await waitForDispatchChange(input);
+                continue;
             }
         }
-        if (selected) {
-            input.eventQueue.replaceQueue(selected.remainingQueue);
-            return {
+        if (selected && selected.batch.events.length > 0) {
+            const dispatch = prepareDispatch({
                 events: selected.batch.events,
                 sourceKey: selected.batch.sourceKey,
                 selected,
-            };
+            });
+            if (dispatch)
+                return dispatch;
+            await waitForDispatchChange(input);
+            continue;
         }
-        const hasDeferredIdleOperatorMessage = input.eventQueue
+        await waitForDispatchChange(input);
+    }
+}
+function isImmediateDispatchSource(sourceKey) {
+    return (sourceKey === 'operator' ||
+        sourceKey === 'operator.reconnect' ||
+        sourceKey === 'permission');
+}
+function waitForDispatchChange(input) {
+    if (input.signal.aborted) {
+        return Promise.reject(new DOMException('Conductor dispatch wait aborted', 'AbortError'));
+    }
+    return new Promise((resolve, reject) => {
+        const subscriptions = [];
+        const queuedOperatorMessages = input.eventQueue
             .snapshot()
-            .some((event) => event.type === 'operator.message' && event.delivery === 'idle') && !input.canDispatchIdleOperatorMessage();
-        // report 単独 send で dispatch hold を迂回しない。hold 解除後は held event が
-        // maxTurns で保留中でも、この有限の通知は送れる。
-        if (input.hasPendingRecoveryReport() &&
-            !input.dispatchHoldState.dispatchHold &&
-            !hasDeferredIdleOperatorMessage) {
-            return {
-                events: [],
-                sourceKey: 'conductor.recovery.report',
-            };
+            .filter((event) => event.type === 'operator.message').length;
+        const cleanup = () => {
+            for (const unsubscribe of subscriptions)
+                unsubscribe();
+            input.signal.removeEventListener('abort', onAbort);
+        };
+        const onChange = () => {
+            cleanup();
+            resolve();
+        };
+        const onAbort = () => {
+            cleanup();
+            reject(new DOMException('Conductor dispatch wait aborted', 'AbortError'));
+        };
+        const onQueueChanged = () => {
+            const nextOperatorMessageCount = input.eventQueue
+                .snapshot()
+                .filter((event) => event.type === 'operator.message').length;
+            if (nextOperatorMessageCount > queuedOperatorMessages) {
+                input.onOperatorQueueChanged?.();
+            }
+            onChange();
+        };
+        subscriptions.push(input.eventQueue.subscribe(onQueueChanged), input.lifecycle.subscribe(onChange), input.recoveryInbox.subscribe(onChange));
+        if (input.signal.aborted) {
+            onAbort();
+        }
+        else {
+            input.signal.addEventListener('abort', onAbort, { once: true });
+        }
+    });
+}
+async function waitForCursorBootstrapDecision(input) {
+    while (input.state.status === 'unknown' ||
+        input.state.status === 'saving') {
+        if (input.signal.aborted) {
+            throw new DOMException('Cursor bootstrap decision wait aborted', 'AbortError');
         }
-        const hadQueued = input.eventQueue.size > 0;
-        const incoming = await input.eventQueue.waitForEvent(input.signal, {
-            onlyNew: hadQueued,
+        await new Promise((resolve, reject) => {
+            let unsubscribe = () => { };
+            let unsubscribeFromEventQueue = () => { };
+            let queuedOperatorMessages = input.eventQueue
+                .snapshot()
+                .filter((event) => event.type === 'operator.message').length;
+            if (queuedOperatorMessages > 0) {
+                input.onOperatorQueueChanged?.();
+            }
+            const cleanup = () => {
+                unsubscribe();
+                unsubscribeFromEventQueue();
+                input.signal.removeEventListener('abort', onAbort);
+            };
+            const finish = () => {
+                cleanup();
+                resolve();
+            };
+            const onStatusChanged = () => {
+                if (input.state.status === 'unknown' ||
+                    input.state.status === 'saving') {
+                    return;
+                }
+                finish();
+            };
+            const onQueueChanged = () => {
+                const nextOperatorMessageCount = input.eventQueue
+                    .snapshot()
+                    .filter((event) => event.type === 'operator.message').length;
+                if (nextOperatorMessageCount > queuedOperatorMessages) {
+                    input.onOperatorQueueChanged?.();
+                }
+                queuedOperatorMessages = nextOperatorMessageCount;
+            };
+            const onAbort = () => {
+                cleanup();
+                reject(new DOMException('Cursor bootstrap decision wait aborted', 'AbortError'));
+            };
+            unsubscribe = input.lifecycle.subscribe(onStatusChanged);
+            unsubscribeFromEventQueue = input.eventQueue.subscribe(onQueueChanged);
+            if (input.signal.aborted) {
+                onAbort();
+            }
+            else {
+                input.signal.addEventListener('abort', onAbort, { once: true });
+                onStatusChanged();
+            }
         });
-        // waiter 経由のイベントは queue に載らない。到着順を保つため先頭へ戻す。
-        input.eventQueue.prependSilent(incoming);
-        if (incoming.type === 'operator.message')
-            input.onOperatorQueueChanged?.();
     }
 }
 function canDispatchIdleOperatorMessage(input) {
@@ -662,17 +907,13 @@ function canDispatchIdleOperatorMessage(input) {
         maxTurns: input.maxTurns,
     }) === undefined);
 }
-function isImmediateDispatchSource(sourceKey) {
-    return (sourceKey === 'operator' ||
-        sourceKey === 'operator.reconnect' ||
-        sourceKey === 'permission');
-}
 /** `/reconnect` は conductor へ送らず、直近 send 完了後に agent だけ差し替える。 */
 async function runOperatorReconnect(options) {
     try {
         await reconnectConductorAgent(options.conductorHandle, {
             conductorAgentFactory: options.sendReconnect.conductorAgentFactory,
             conductorOptions: options.sendReconnect.conductorOptions,
+            signal: options.shutdownSignal,
             onReconnectAttempt: options.sendReconnect.onTransportReconnectAttempt ??
                 options.sendReconnect.onReconnectAttempt,
             onReconnectComplete: options.sendReconnect.onTransportReconnectComplete ??